摘要
应用广泛的Kerberos协议缺乏支持集中式授权的机制,无法解决集团型企业跨域访问控制问题。本文提出一种基于Kerberos的统一认证授权方案KCAA,通过Kerberos与授权中心的无缝集成,有效实现总部对跨域访问的集中式认证授权。KCAA采用抽象用户减少各域内信息同步量,并采用身份代理简化Kerberos的部署。在大规模集团型企业信息化建设中的应用表明,KCAA无需对现有系统进行大规模改造,即可实现集中式跨域访问控制,具有良好应用价值。
Because of lacking support for centralized authorization, widely-applied Kerberos couldn＇t realize cross-domain access control in group enterprises. Therefore, a Kerberos-based Centralized Authentication Authorization （KCAA） scheme is proposed. By integrating centralized authorization into Kerberos, KCAA achieves centralized authentication and authorization in headquarter for cross-domain access. KCAA uses abstract users to reduce information synchronization in different domains, and identity agents to simplify deployment of Kerberos. KCAA shows its application value in the informatization construction of a large group enterprise which proves that it could achieve centralized cross-domain access control without mass transformation of legacy systems.
出处
《微计算机信息》
2009年第9期1-2,41,共3页
Control & Automation
